Description

LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it’s possible to modify LDAP statements using a local proxy. This could result in the execution of arbitrary command such as granting permissions to unauthorized queries, and content modification inside the LDAP tree.
The same advanced exploitation techniques available in SQL Injection can be similarly applied in LDAP Injection.

Examples

Example 1

In a page with a user search form, the following code is responsible to catch input value and generate a LDAP query that will be used in LDAP database.

Example 2

The following vulnerable code is used in an ASP web application which provides login with LDAP data base.
On line 11, the variable userName is initialized and validated to check if it’s not in blank. Then, the content of this variable is used to construct a LDAP query used by SearchFilter on line 28. The attacker has the chance specify what will be queried on LDAP server, and see the result on the line 33 to 41, are all results and their attributes are displayed.

In the example above, we send the * character in the user parameter which will result in the filter variable in the code to be initialized with (uid=*). The resulting LDAP statement will make the server return any object that contains a uid attribute like username.